Merge tag 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/rdma/rdma

Pull rdma fixes from Jason Gunthorpe:
 "This fixes one major regression with NFS and mlx4 due to the max_sg
  rework in this merge window, tidies a few minor error_path
  regressions, and various small fixes.

  The HFI1 driver is broken this cycle due to a regression caused by a
  PCI change, it is looking like Bjorn will merge a fix for this. Also,
  the lingering ipoib issue I mentioned earlier still remains unfixed.

  Summary:

   - Fix possible FD type confusion crash

   - Fix a user trigger-able crash in cxgb4

   - Fix bad handling of IOMMU resources causing user controlled leaking
     in bnxt

   - Add missing locking in ipoib to fix a rare 'stuck tx' situation

   - Add missing locking in cma

   - Add two missing missing uverbs cleanups on failure paths,
     regressions from this merge window

   - Fix a regression from this merge window that caused RDMA NFS to not
     work with the mlx4 driver due to the max_sg changes"

* tag 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/rdma/rdma:
  RDMA/mlx4: Ensure that maximal send/receive SGE less than supported by HW
  RDMA/cma: Protect cma dev list with lock
  RDMA/uverbs: Fix error cleanup path of ib_uverbs_add_one()
  bnxt_re: Fix couple of memory leaks that could lead to IOMMU call traces
  IB/ipoib: Avoid a race condition between start_xmit and cm_rep_handler
  iw_cxgb4: only allow 1 flush on user qps
  IB/core: Release object lock if destroy failed
  RDMA/ucma: check fd type in ucma_migrate_id()

1 files changed, 7 insertions, 5 deletions

diff --git a/drivers/infiniband/core/cma.c b/drivers/infiniband/core/cma.c
index f72677291b69..a36c94930c31 100644
--- a/drivers/infiniband/core/cma.c
+++ b/drivers/infiniband/core/cma.c
@@ -724,6 +724,7 @@ static int cma_resolve_ib_dev(struct rdma_id_private *id_priv)
         dgid = (union ib_gid *) &addr->sib_addr;
         pkey = ntohs(addr->sib_pkey);
 
+        mutex_lock(&lock);
         list_for_each_entry(cur_dev, &dev_list, list) {
                 for (p = 1; p <= cur_dev->device->phys_port_cnt; ++p) {
                         if (!rdma_cap_af_ib(cur_dev->device, p))
@@ -750,18 +751,19 @@ static int cma_resolve_ib_dev(struct rdma_id_private *id_priv)
                                         cma_dev = cur_dev;
                                         sgid = gid;
                                         id_priv->id.port_num = p;
+                                        goto found;
                                 }
                         }
                 }
         }
-
-        if (!cma_dev)
-                return -ENODEV;
+        mutex_unlock(&lock);
+        return -ENODEV;
 
 found:
         cma_attach_to_dev(id_priv, cma_dev);
-        addr = (struct sockaddr_ib *) cma_src_addr(id_priv);
-        memcpy(&addr->sib_addr, &sgid, sizeof sgid);
+        mutex_unlock(&lock);
+        addr = (struct sockaddr_ib *)cma_src_addr(id_priv);
+        memcpy(&addr->sib_addr, &sgid, sizeof(sgid));
         cma_translate_ib(addr, &id_priv->id.route.addr.dev_addr);
         return 0;
 }